As a valid assumption in the FL system among medical centers, we assume every client, including those malicious ones, follows the given training protocol. For instance, they compute gradients correctly as instructed by the server and update the exact parameters when needed. By requiring FL computations to be carried out on trusted hardware, this can be accomplished [1]}.
